Skip to content

Commit dcfe322

Browse files
committed
docs: add v2.3.0 release notes and v2.3.0-next placeholder
1 parent af17ee2 commit dcfe322

2 files changed

Lines changed: 64 additions & 0 deletions

File tree

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Release Notes
2+
3+
## Version
4+
5+
v2.3.0-next
6+
7+
## Release Date
8+
9+
2026-07-22
10+
11+
---
12+
13+
## Full Changelog
14+
15+
v2.3.0...HEAD
16+
Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Release Notes
2+
3+
## v2.3.0 — Frontend Security Auditing & Client-Side Secret Detection
4+
5+
### Highlights
6+
7+
Minor release adding frontend security auditing (CSP, CORS, cookies, SRI, XSS, open redirect, insecure forms, vulnerable CDN), client-side storage token detection, response header API key scanning, fingerprint state management library detection, and a comprehensive test suite for the scanner. All historical release notes have been rewritten in a user-friendly format.
8+
9+
### What's New
10+
11+
#### Secret Detection
12+
13+
- **Client-side storage token detection** — Scans `localStorage`, `sessionStorage`, and `IndexedDB` references for stored tokens, secrets, and sensitive identifiers
14+
- **Fingerprint state management library detection** — Identifies state management libs (Redux, Zustand, Pinia, Vuex, etc.) used in client-side apps
15+
- **Response header API key scanning** — Scans response headers for exposed API keys and secrets
16+
17+
#### Frontend Security Auditing
18+
19+
- **CSP audit** — Evaluates Content-Security-Policy headers for weaknesses (missing directives, unsafe-inline, unsafe-eval, missing nonces)
20+
- **CORS audit** — Checks Cross-Origin Resource Sharing policies for overly permissive configurations
21+
- **Cookie security audit** — Inspects cookies for missing `HttpOnly`, `Secure`, and `SameSite` flags
22+
- **SRI verification** — Detects missing Subresource Integrity attributes on script and link tags
23+
- **XSS vulnerability scanning** — Probes endpoints for reflected XSS vulnerabilities
24+
- **Open redirect detection** — Identifies endpoints that allow unvalidated redirects
25+
- **Insecure form detection** — Flags forms submitted over HTTP instead of HTTPS
26+
- **Vulnerable CDN detection** — Identifies outdated or known-vulnerable CDN libraries
27+
28+
#### Engine Improvements
29+
30+
- **Comprehensive test suite** — Added thorough test coverage for scanner components, including secret detection, fingerprinting, and auditing modules
31+
32+
### Documentation
33+
34+
- Rewrote all historical release notes (v1.0.0 through v2.2.0-next) in a consistent, user-friendly format
35+
- Added missing release notes for v2.2.0-next, v2.2.0, v2.1.1, v2.1.0, v2.0.0, v1.1.6, v1.1.4, v1.1.1, v1.0.1, v1.0.0
36+
37+
### Maintenance
38+
39+
- Added git-rndocs release notes generation config and template for consistent formatting
40+
41+
### Contributors
42+
43+
- Mark Wayne Buncaras Menorca (25 commits)
44+
45+
### Full Changelog
46+
47+
v2.2.0...v2.3.0
48+

0 commit comments

Comments
 (0)